dm-buffered: fix a bug if the buffer is allocated from a slab cache If the buffer size is smaller than the page size, the bufio subsystem uses a slab cache to allocate the buffer data. The dm-bufferef code calls virt_to_page and kmap_local_page, that incorrectly rounds the pointer down to the beginning of the page - causing memory corruption and data corruption. To fix this bug, we use offset_in_page. Signed-off-by: Mikulas Patocka --- drivers/md/dm-buffered-target.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) Index: linux-2.6/drivers/md/dm-buffered-target.c =================================================================== --- linux-2.6.orig/drivers/md/dm-buffered-target.c +++ linux-2.6/drivers/md/dm-buffered-target.c @@ -233,7 +233,7 @@ static void _io(struct buffered_c *bc, s buffer_page = unlikely(is_vmalloc_addr(buffer)) ? vmalloc_to_page(buffer) : virt_to_page(buffer); _memcpy(bio, bc, bp, buffer_page, bvec->bv_page, - buffer_offset & ~PAGE_SIZE, bvec_offset, len, + offset_in_page(buffer), bvec_offset, len, _init_async_memcpy(bio, bc, bp, buffer_offset, len)); } else { /* (Superfluous) function consistency check example */ @@ -242,7 +242,7 @@ static void _io(struct buffered_c *bc, s buffer_page = unlikely(is_vmalloc_addr(buffer)) ? vmalloc_to_page(buffer) : virt_to_page(buffer); _memcpy(bio, bc, bp, bvec->bv_page, buffer_page, - bvec_offset, buffer_offset & ~PAGE_SIZE, len, + bvec_offset, offset_in_page(buffer), len, _init_async_memcpy(bio, bc, bp, 0, 0)); }